Perhaps I'm misunderstanding, but this line:
|
if (!IsValidRequest(context.Request) || !IsTestEnvironment) |
Shouldn't that be if (!IsValidRequest(context.Request) && !IsTestEnvironment)? If the request is not valid and we're not in the test environment, then give the 403.